Sessions, tokens, passwords, and frameworkishness.

On the to-do list: find out a good way for guest sessions to change
frequently without causing token errors (and sessions in general).

 - Silently pass the token check for tokenless guest cookies?
 - Require user to perform actions again?

Neither of these really expand to user sessions, though those
should probably live for several months.